Can a Medical Practice Send Patient Results Through WhatsApp?

A patient asks for their pathology result. They want it now. WhatsApp is right there. Your receptionist types the number, attaches the file, and sends. It's done in ten seconds. It's also one of the most common POPIA exposure points in South African healthcare.

This article isn't a legal opinion, and it doesn't say 'never use WhatsApp'. It sets out the operational questions a practice should answer before patient information goes through it.

The core problem: WhatsApp is not a health information system

WhatsApp is a consumer messaging app. It's not designed for processing personal information in a regulated environment. When patient data flows through it, several things happen that most practices haven't thought through:

• The file sits on the sender's and recipient's personal devices — outside any practice control or retention policy.
• There's no access log. You can't prove who sent what, when, or to whom.
• A wrong number means patient information goes to a stranger — and you may not know until the patient asks why they never received it.
• If the staff member's phone is lost or shared, the patient data goes with it.

The POPIA question isn't 'is WhatsApp allowed' — it's 'what controls do you have'

POPIA doesn't ban specific tools. It requires that personal information is processed lawfully and with reasonable security measures. The question a regulator would ask isn't 'did you use WhatsApp' but 'what controls did you have around it'.

If the answer is 'none' — no verification of the number, no consent, no log, no retention rule — that's the problem, not the app itself.

Practical controls if your practice does use WhatsApp

Verify before you send

Confirm the patient's number verbally or against a record before sending anything. A wrong number is the single most common WhatsApp incident in practices.

Use WhatsApp Business, not personal accounts

WhatsApp Business at least keeps practice communication separate from personal. It doesn't solve everything, but it's a baseline.

Get and record consent

If a patient wants results via WhatsApp, record that consent in their file. It doesn't eliminate the risk, but it demonstrates the lawful basis POPIA requires.

Prefer links over files

Where possible, send a link to a secure portal rather than attaching the document directly. A link can be revoked; a file on someone's phone can't.

Set a clear rule and train staff

Write down what may and may not be sent via WhatsApp, and make sure every staff member — including locums — knows the rule. An unwritten rule isn't a control.

The honest answer

Can a practice send patient results through WhatsApp? It can — but only with the right controls in place. Sending without them is the operational equivalent of handing a stranger a patient file and hoping they're the right person. The app isn't the risk. The absence of controls is.